CVE-2014-2909

CVE-2014-2909 describes a CRLF injection vulnerability in the integrated web server of Siemens SIMATIC S7-1200 CPU family (versions 2.x and 3.x) that could enable HTTP header injection. The issue is categorized as an HTTP response splitting risk with a CVSS v2 base score of 5.8 (network access, m...

CVE-2014-2908

CVE-2014-2908 describes a cross-site scripting (XSS) vulnerability in the integrated web server of Siemens SIMATIC S7-1200 CPU devices (2.x and 3.x). The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, potentially executing script in the affected user...

PT-2015-13: Unauthorized Access in Siemens SIMATIC HMI Devices

The specialists of the Positive Research center have detected a Unauthorized Access vulnerability in Siemens SIMATIC HMI Devices. The vulnerability allows remote attackers to obtain password hashes for SIMATIC WinCC users and complete authentication. How to fix Update your sofware up to the lates...

PT-2014-16: Privilege Gaining in Siemens SIMATIC WinCC

The specialists of the Positive Research center have detected a Privilege Gaining vulnerability in SIMATIC WinCC. A hard coded encryption key could allow privilege escalation in the WinCC Project administration application if its network communication on port 1030/tcp of a legitimate user can be...

Siemens SIMATIC S7-1200 Multiple DoS Vulnerabilities (SSA-654382)

Siemens SIMATIC S7-1200 devices are prone to multiple denial of service DoS vulnerabilities. Copyright C 2014 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later...

Code injection

The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors, a different vulnerability than...

CVE-2014-2252

Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service defect-mode transition via crafted PROFINET packets, a different vulnerability than CVE-2014-2253...

CVE-2014-2254

CVE-2014-2254 affects Siemens SIMATIC S7-1200 CPU PLCs with firmware prior to 4.0. The vulnerability allows remote DoS (defect-mode transition) by sending crafted HTTP packets to the device’s web server (Port 80/443). Root cause is related to improper handling within the device’s HTTP interface, ...

CVE-2014-2258

CVE-2014-2258 affects Siemens SIMATIC S7-1200 CPU PLCs with firmware before 4.0. A crafted HTTPS packet can trigger a defect-mode transition, causing a denial of service. The issue is distinct from CVE-2014-2259. The vulnerability is triggered via remote network access to the device’s HTTPS handl...

CVE-2014-2250

The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors, a different vulnerability than...

CVE-2014-2250

CVE-2014-2250 concerns Siemens SIMATIC S7-1200 CPUs with firmware before 4.0, where the PRNG has insufficient entropy. This weaknesses can enable remote attackers to defeat cryptographic protections and hijack sessions via unspecified vectors. Public material ties this to the S7-1200 family and n...

Siemens SIMATIC S7-1200多个漏洞

CVE ID: CVE-2014-2249,CVE-2014-2250,CVE-2014-2252,CVE-2014-2254,CVE-2014-2256,CVE-2014-2258 SIMATIC S7-1200是可编程控制器，可实现简单却高度精确的自动化任务。 Siemens SIMATIC S7-1200 4.0.0之前版本在实现上存在多个漏洞，可被恶意利用执行跨站请求伪造、劫持用户会话、造成拒绝服务。 1、向TCP端口443发送特制的数据包造成的错误可造成设备进入defect模式。 2、随机生成器内弱熵相关错误，可导致劫持另外用户的会话。...

PT-2014-15: Privilege Gaining in Siemens SIMATIC WinCC

The specialists of the Positive Research center have detected a Privilege Gaining vulnerability in SIMATIC WinCC. Access permissions on system objects could allow a local user to obtain limited escalated privileges within the operating system. How to fix Update your software up to the latest...

CVE-2014-2246

Cross-site scripting XSS vulnerability in the integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Open redirect

Open redirect vulnerability in the integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

Code injection

The random-number generator on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors...

CVE-2014-2248

Open Redirect vulnerability CVE-2014-2248 affects Siemens SIMATIC S7-1500 CPU PLCs with web server (ports 80/443). Root cause: open redirect in the integrated web server, enabling remote attackers to redirect users to untrusted sites and facilitate phishing. Affects firmware older than 1.5.0; mit...

CVE-2014-2255

Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service defect-mode transition via crafted HTTP packets...

CVE-2014-2248

Open redirect vulnerability in the integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2014-2246

CVE-2014-2246 is an XSS vulnerability in the integrated web server of Siemens SIMATIC S7-1500 CPU PLCs with firmware older than 1.5.0 . The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The affected component is the web server running on the PLC dev...